YT YouTube2Text

YouTube2Text → Transcripts → CSJ June 2026 Article

CSJ June 2026 Article — Transcript

by The Institute of Company Secretaries of India · 2,216 words · 397 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:01Digital Personal Data Protection Act
0:032023
0:05Compliance Architecture and Emerging
0:07Professional Implications Authors Dr.
0:10Sajoy PB and Dr. Ajoy PB Abstract the
0:14primary objective of the DPDP Act 2023
0:19is disclosed in the long title of the
0:21Act.
0:22It clearly states that the Act seeks to
0:25enable the processing of digital
0:26personal data in a manner that
0:28recognizes not only the right of
0:31individuals to protect their personal
0:33data but also the need to process such
0:36data for lawful purposes. Introduction,
0:39the central government has after much
0:41delay and debate notified the timeline
0:44within which the Digital Personal Data
0:47Protection Act 2023
0:50DPDP Act 2023
0:53will be enforced.
0:55Considering the apprehensions raised by
0:57various sections of society including
1:00corporates,
1:02non-governmental organizations and civil
1:04rights activists, the central government
1:07has adopted an 18-month step-by-step
1:10rollout program for enforcing the Act.
1:13As a first step, the provisions relating
1:16to the Data Protection Board of India
1:18DPBI have been enforced with effect from
1:2213th November 2025.
1:25By a separate notification, the said
1:28board has been established with its
1:30headquarters at the National Capital
1:33Region of India.
1:35The total strength of the board has been
1:37fixed at four members.
1:39The next step involves the bringing into
1:42force those provisions of the Act
1:44relating to consent managers and their
1:46registration with the board with effect
1:49from 13th November 2026.
1:53Finally, the remaining provisions of the
1:55Act
1:57including the new rights and liability
1:59regime will come into force on 13th May
2:022027.
2:05Till then, the criminal liability regime
2:08already existing under the Information
2:10Technology Act 2000 will continue.
2:14This 1 and 1/2 year transitional period
2:16provides all stakeholders with
2:19sufficient time to adapt themselves to
2:21the new liability regime that will
2:23eventually come into force.
2:26This article provides a bird's-eye view
2:28of the new legal framework being set up
2:31under the DPDP Act 2023.
2:35Conceptual framework, the primary
2:38objective of the DPDP Act 2023
2:41is disclosed in the long title of the
2:44act.
2:45It clearly states that the act seeks to
2:47enable the processing of digital
2:49personal data in a manner that
2:51recognizes not only the right of
2:54individuals to protect their personal
2:56data, but also the need to process such
2:59data for lawful purposes.
3:02A definition has been provided in the
3:04act for data and personal data with the
3:07intent of clearly defining the scope of
3:09the legislation.
3:11Every representation of information,
3:14facts, etc. that is shared or stored in
3:17cyberspace and is capable of being
3:19communicated, interpreted, or processed
3:22is defined as data.
3:25However, only such data about any
3:27individual that discloses some aspect of
3:30his/her identity is treated as personal
3:33data.
3:35Examples of personal data of an
3:37individual includes his/her name, age,
3:40image, gender, address, phone number,
3:43PAN card details, Aadhaar details, bank
3:46account details, credit card details,
3:49etc. To achieve the objectives of the
3:52act, four conceptual entities, namely A,
3:55data principal, B, data fiduciary, C,
3:59data processor, and D, consent manager,
4:02have been created.
4:04Data principal refers to an individual
4:07whose personal data is being processed,
4:09whereas data fiduciary refers to any
4:12person who determines the purpose and
4:14means of processing the personal data of
4:17data principals.
4:19Data processor refers to any person who
4:22is engaged by the data fiduciary for
4:24processing the personal data of data
4:27principals.
4:28For example, suppose an individual A
4:32purchases medicines from an online
4:34pharmacy B.
4:36In addition to the medical prescription,
4:39A may provide his credit card details to
4:41B for making payments.
4:44A may also provide his postal address to
4:47B for delivering the medicines.
4:49B may engage C to process the personal
4:52data of customers like A.
4:55Here, A is the data principal, B is the
4:58data fiduciary, and C is the data
5:00processor.
5:02A data principal may engage
5:04himself/herself in several transactions
5:07with different data fiduciaries.
5:10Since it is practically difficult for a
5:12data principal to keep an updated record
5:15of all personal data given by his/her to
5:17different data fiduciaries, the act
5:20permits the data principal to take the
5:22assistance of any consent manager who is
5:25registered with the data protection
5:27board of India.
5:29The consent manager is essentially an
5:32online platform where a data principal
5:34can store his/her personal data.
5:37He/she uses the said platform for the
5:40purpose of giving/withdrawing consent to
5:42the processing of his/her personal data
5:45by various data fiduciaries on board
5:47onto the platform and subscribed by his
5:50her for availing various services.
5:53Thus, the consent manager acts as an
5:56intermediary between the data principal
5:59and the data fiduciary.
6:01The DPDP Act 2023
6:04imposes several obligations on a data
6:07fiduciary in relation to the personal
6:09data of a data principal which must be
6:12fulfilled before or at the time of
6:14processing the said data for business or
6:17other lawful purposes.
6:19The primary obligation is to obtain the
6:22consent of the data principal before
6:24processing his her personal data.
6:27The consent obtained from the data
6:29principal must be free, specific,
6:32informed, unconditional, unambiguous,
6:34and accompanied by a clear affirmative
6:37action.
6:38The DPDP Act and rules require data
6:41fiduciaries to issue notices in simple
6:44language to the data principal while
6:46obtaining consent.
6:48Also, the personal data can be processed
6:51only to the extent necessary for
6:54fulfilling the purpose for which consent
6:56was obtained.
6:58Further, the data fiduciary is under a
7:00statutory obligation to stop further
7:03processing of the personal data of a
7:05data principal once the data principal
7:08withdraws consent.
7:10For the purpose of enabling easy
7:12withdrawal of consent, the original
7:14consent notice should contain an online
7:17communication link that can be utilized
7:20by the data principal for withdrawing
7:22the consent.
7:24The Act also requires a data fiduciary
7:27to provide a grievance redressal
7:29mechanism for enabling the data
7:31principal to redress any grievance.
7:34Additionally, every data fiduciary is
7:36tasked with an obligation to promptly
7:39report every personal data breach to the
7:41data protection board of India as well
7:44as to each affected data principle.
7:47Even though the act prescribes a
7:49consent-based data processing regime, it
7:52also permits the data fiduciary to
7:54process the personal data of a data
7:57principle independent of his her consent
7:59in certain limited circumstances like
8:02responding to medical emergencies, for
8:04complying with judicial orders, for
8:07taking measures during disasters or
8:09epidemics, for protecting intellectual
8:12property rights of employers.
8:15For protecting the sovereignty and
8:17integrity of India or security of the
8:20state, for complying with any obligation
8:23under law, etc.
8:25Data Protection Board of India DPBI, the
8:28act empowers the central government to
8:31establish a Data Protection Board of
8:33India DPBI for ensuring effective
8:36implementation of the DPDP Act 2023.
8:41The board consists of a chairperson and
8:44three members, all of them appointed for
8:47a term of two years having expertise in
8:50law, dispute resolution, digital
8:52economy, administration, data
8:55governance, etc.
8:57The primary function of the board is to
8:59inquire into complaints made by a data
9:02principle in respect of any personal
9:04data breach or failure of the data
9:07fiduciary consent manager to observe
9:09statutory obligations and impose penalty
9:12as provided under the act.
9:15After inquiry,
9:17its duties also include taking quick
9:20remedial responses to any intimation of
9:23personal data breach by any data
9:25fiduciary.
9:27The board, in the performance of its
9:29functions, is vested with several powers
9:32of a civil court including powers to
9:34issue interim orders.
9:37The board is also expected to follow the
9:39principles of natural justice while
9:42performing its adjudicatory functions.
9:45The orders of the board are subject to
9:47appeal before the Telecom Disputes
9:50Settlement
9:51and Appellate Tribunal TDSAT constituted
9:55under the Telecom Regulatory Authority
9:57of India Act 1997.
10:01Liability regime, the DPDP Act 2023
10:05seeks to replace the existing criminal
10:08liability regime for data protection
10:10with a penalty-based liability regime.
10:13Under the new liability regime, if the
10:16Data Protection Board of India on an
10:18inquiry conducted by it determines that
10:21there has been a significant breach of
10:24the provisions of the Act by any person,
10:26then it is empowered to impose monetary
10:29penalties on that person after hearing
10:32him.
10:33While the schedule to the Act specifies
10:35the maximum penalties that can be
10:38imposed for different breaches, the
10:40actual quantum of penalty to be imposed
10:43has to be determined by the board after
10:45taking into consideration several
10:47factors including the nature,
10:50gravity, and duration of the breach, the
10:53type and nature of the personal data
10:56affected by the breach, the repetitive
10:58nature of the breach, whether the person
11:00responsible for the breach has derived
11:03any benefit from the breach, whether
11:05effective and timely steps were taken to
11:08mitigate the effects of the breach, and
11:10the likely impact of the monetary
11:12penalty on the person responsible for
11:15the breach.
11:16Miscellaneous features, apart from the
11:19broad features discussed above, the Act
11:21has incorporated several additional
11:24features.
11:25The Act requires the board to explore
11:28the possibility of resolution of
11:30complaints by mediation or by any other
11:33alternate dispute resolution mechanism.
11:36The central government has powers under
11:39the act to strictly regulate the
11:40transfer of personal data by a data
11:43fiduciary to any other country or
11:45territory outside India.
11:48Further, the act empowers the central
11:50government to classify data fiduciaries
11:53as significant data fiduciaries based on
11:56several factors such as the volume and
11:59sensitivity of personal data processed,
12:01risk to the rights of data principles,
12:04and the legitimate concerns of the state
12:06relating to security, sovereignty, and
12:09integrity of India.
12:11Once so classified,
12:14the data fiduciary will have to meet
12:16additional statutory obligations such as
12:19conducting periodic independent data
12:21audits, undertaking data protection
12:24impact assessment, and appointing a data
12:26protection officer based in India who
12:29will be responsible to the governing
12:31body of the data fiduciary.
12:33The act also allows the central
12:35government, on a reference made to it by
12:38the board, to block access by the public
12:40to any information hosted by a data
12:43fiduciary under certain circumstances
12:45after hearing the data fiduciary.
12:48Impact on the profession of company
12:50secretary, once the DPDP Act 2023
12:55becomes fully operational in May 2027,
12:59company secretaries will need to prepare
13:01additional compliance reports
13:03particularly for data-driven companies.
13:07Unless adequately trained, company
13:09secretaries will have to rely on the
13:11reports prepared by cybersecurity
13:14professionals and data auditors.
13:17Hence, there is an urgent need for
13:19capacity building in cybersecurity and
13:22data protection laws for company
13:24secretaries.
13:26This objective can be achieved in the
13:28short term by organizing training
13:30programs, seminars, workshops, refresher
13:34courses, etc.
13:36In the long term, the syllabus of the
13:38company secretary program may have to be
13:41suitably modified to include topics
13:43relating to digital data protection and
13:46cybersecurity compliance.
13:48Conclusion: Through the DPDP Act 2023,
13:53Parliament has laid down strong
13:55regulatory framework for efficient
13:57processing of digital personal data even
14:00while safeguarding the privacy rights of
14:02individuals.
14:04The Act is being enforced in a gradual
14:07and phased manner so as to give
14:09sufficient time to the data fiduciaries
14:12and consent managers to put in place the
14:14infrastructure necessary to comply with
14:17the provisions of the Act.
14:19When fully enforced, the DPDP Act 2023
14:24will go a long way to advance the
14:26objectives of Digital India.
14:28References: CGSR 843 E F No.
14:34A 1103812025
14:38CLES dated 13th November 2025
14:43CGSR 844 E F No.
14:47A 1103812025
14:51CLES dated 13th November 2025
14:56CGSR 845 E F No.
15:00A 1103812025
15:04CLES dated 13th November 2025
15:09C Section 43 of the Information
15:12Technology Act 2000.
15:15The said provision will be repealed by
15:17virtue of Section 44 2A of DPDP Act 2023
15:23when the new penalty based liability
15:25regime comes into force on 13th May
15:282027.
15:30Section 2 H of the DPDP Act 2023.
15:35Section 2 T of the DPDP Act 2023.
15:40Section 2 J of the DPDP Act 2023.
15:45Section 2 I of the DPDP Act 2023.
15:49Section 2 K of the DPDP Act 2023.
15:54Section 2 G of the DPDP Act 2023.
15:59Section 8 2 of the DPDP Act
16:032023.
16:05Sections 6 7 to 6 9 of the DPDP Act
16:102023.
16:12See first schedule of the DPDP Rules
16:142025.
16:16Sections 4 5 and 6 of the DPDP Act 2023.
16:22Section 6 1 of the DPDP Act 2023.
16:27Sections 6 4 to 6 6 of the DPDP Act
16:322023.
16:34See Section 6 3 of the DPDP Act 2023
16:39and Rule 3 of the DPDP Rules 2025.
16:43Section 13 of the DPDP Act 2023.
16:48Section 8 6 of the DPDP Act 2023.
16:53Section 7 C to 7 I of the DPDP Act 2023.
17:00Section 18 of the DPDP Act 2023.
17:05DPBI has already been established.
17:09See Supra Note 2 Sections 19 20 of the
17:12DPDP Act 2023.
17:15Section 27 2 of the DPDP Act 2023,
17:21section 27 one of the DPDP Act 2023,
17:26section 28 10 of the DPDP Act 2023,
17:32section 28 six of the DPDP Act
17:362023,
17:38section 29 of the DPDP Act 2023,
17:42section 44 two A of the DPDP Act 2023,
17:48section 27 one B of the DPDP Act 2023,
17:54section 33 one of the DPDP Act 2023.
17:59The maximum penalty imposed under the
18:02Act can be as high as 250 crores rupees.
18:06See schedule of the DPDP Act 2023,
18:10section 33 two of DPDP Act 2023,
18:16section 31 of the DPDP Act 2023,
18:20section 16 of the DPDP Act 2023,
18:25section 10 one of the DPDP Act 2023,
18:30section 10 two of the DPDP Act 2023,
18:35section 37 of the DPDP Act 2023.

About this transcript

This page contains the full transcript of CSJ June 2026 Article by The Institute of Company Secretaries of India, generated from the public captions YouTube serves with the video. The transcript has 2,216 words across 397 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.